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IN THE CLAIMS: 
Amended claims follow: 

1. (currently amended) A computer program product comprising a computer 
program operable to control a computer to detect a known computer program within a 
packed computer file, said packed computer file being unpacked upon execution, said 
computer program comprising: 

resource data reading logic for reading resource data within said packed computer 
file, said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

resource data comparing logic for generating characteristics of said resource data 
and for comparing said characteristics of said resource data with characteristics of 
resource data of said known computer program and for detecting a match with said 
known computer program indicative of said packed computer file containing said known 
computer program: 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program: 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data; 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data . 
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2. (original) A computer program product as claimed in claim 1, wherein said 
known computer program is one of: 

a Trojan computer program; and 
a worm computer program, 

3. (original) A computer program product as claimed in claim l s wherein said 
resource data comparing logic is operable to compare said resource data with 
characteristics of a plurality of known computer programs to detect if said packed 
computer program contains one of said plurality of known computer programs. 

4. (cancelled) 

5. (original) A computer program product as claimed in claim 1, wherein said 
program resource items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 
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6. (original) A computer program product as claimed in claim 1, wherein said 
resource data specifies for each resource item a storage location of said resource item. 

7. (original) A computer program product as claimed in claim 6, wherein said 
storage location of said resource item is specified as an relative offset value. 

8. (original) A computer program product as claimed in claim 1, wherein said 
resource data specifies for each resource item a size of said resource item. 

9. (currently amended) A computer program product as claimed in claim [4].L 
wherein said fingerprint data includes a checksum value calculated in dependence upon 
one or more of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

10. (cancelled) 

1 1 . (currently amended) A computer program product as claimed in claim [4]V, 
wherein said fingerprint data includes a location within said resource data of an entry 
specifying a program resource item having a largest size. 
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12, (currently amended) A computer program product as claimed in claim [4]L 
wherein said fingerprint data includes timestamp data indicative of a time of compilation 
of said known computer program. 

13, (cancelled) 

14, (original) A computer program product as claimed in claim 9, wherein said 
checksum value is rotated between each item being added into said checksum. 

15, (original) A computer program product as claimed in claim 1, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 

16, (original) A computer program product as claimed in claim 1, wherein said 
packed computer file is a Win32 PE file. 

17, (currently amended) A computer program product comprising a computer 
program operable to control a computer to generate data for detecting a known computer 
program within a packed computer file, said packed computer file being unpacked upon 
execution, said computer program comprising: 

resource data reading logic for reading resource data within said packed computer 
file, said resource data specifying program resource items used by said known computer 
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program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

characteristic data generating logic for generating characteristic data associated 
with said resource data for comparison with characteristic data of resource data of said 
known computer program to detect a match with said known computer program 
indicative of said packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program: 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data: 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data , 

18. (original) A computer program product as claimed in claim 17, wherein said 
known computer program is ofte of: 

a Trojan computer program; and 
a worm computer program. 

19. (currently amended) A computer program product as claimed in claim 17, 
wherein said characteristic data generating logic is operable to generate characteristic 
data from a plurality of known computer programs to enable detection of any of said 
plurality of known computer programs within said packed computer program.f.] 
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20. (cancelled) 

21 . (original) A computer program product as claimed in claim 17, wherein said 
program resource items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

22. (original) A computer program product as claimed in claim 17, wherein said 
resource data specifies for each resource item a storage location of said resource item. 

23. (original) A computer program product as claimed in claim 22, wherein said 
storage location of said resource item is specified as an relative offset value. 

24. (original) A computer program product as claimed in claim 17 f wherein said 
resource data specifies for each resource item a size of said resource item. 
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25. (currently amended) A computer program product as claimed in claim [20J17, 
wherein said fingerprint data includes a checksum value calculated in dependence upon 
one or more of; 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

sizes of program resource items within said resource data. 

26. (cancelled) 

27. (currently amended) A computer program product as claimed in claim [20] 17, 
wherein said fingerprint data includes a location within said resource data of an entry 
specifying a program resource item having a largest size. 

28. (currently amended) A computer program product as claimed in claim [20] 17, 
wherein said fingerprint data includes timestamp data indicative of a time of compilation 
of said known computer program. 

29. (cancelled) 

30. (original) A computer program product as claimed in claim 25, wherein said 
checksum value is rotated between each item being added into said checksum. 



PAGE 15/34 * RCVD AT 12112/2005 10:23:0? PM [Eastern Standard Time] * SVR:USPTO-EFXRF-6/24 * DNIS:273830Q * CSID:4089714660 * DURATION (mm-ss):06-12 



DEC. 1 2. 2005 7:35PM Z I LKA-KOTAB, PC 



NO. 1 293 P. 16 



31 . (original) A computer program product a$ claimed in claim 17, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 

32. (original) A computer program product as claimed in claim 17, wherein said 
packed computer file is a Win32 PE file. 

33. (currently amended) A method of controlling a computer to detect a known 
computer program within a packed computer file, said packed computer file being 
unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 

generating characteristics of said resource data and comparing said characteristics 
of said resource data with characteristics of resource data of said known computer 
program and detecting a match With characteristics of said known computer program 
indicative of said packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer pro gram; 
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wherein said fingerprint data includes a number of program resource items 
specified within said resource data: 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data . 

34. (original) A method as claimed in claim 33, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

35. (original) A method as claimed in claim 33, wherein said step of comparing 
compares said resource data with characteristics of a plurality of known computer 
programs to detect if said packed computer program contains one of said plurality of 
known computer programs. 

36. (cancelled) 

37. (original) A method as claimed in claim 33, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
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menu data; and 
language data. 

38. (original) A method as claimed in claim 33, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

39. (original) A method as claimed ift claim 38, wherein said storage location of 
said resource item is specified as an relative offset value. 

40. (original) A method as claimed in claim 33, wherein said resource data 
specifies for each resource item a size of said resource item* 

41 . (currently amended) A method as claimed in claim [36]33, wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

42. (cancelled) 
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43. (currently amended) A method as claimed in claim [36]33, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resource item having a largest size. 

44. (currently amended) A method as claimed in claim [36J33, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

45. (cancelled) 

46. (original) A method as claimed in claim 41, wherein said checksum value is 
rotated between each item being added into said checksum. 

47. (original) A method as claimed in claim 33, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

48. (original) A method as claimed in claim 33, wherein said packed computer 
file is a Win32 PE file. 

49. (currently amended) A method of controlling a computer to generate data for 
detecting a known computer program within a packed computer file, said packed 
computer file being unpacked upon execution, said method comprising the steps of: 
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reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 

generating characteristic data associated with said resource data for comparison 
with characteristic data of resource data of said known computer program and detecting a 
match with said known computer program indicative of said packed computer file 
containing said known computer program; 

Wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program: 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data: 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data . 

50. (original) A method as claimed in claim 49, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

51. (currently amended) A method as claimed in claim 49, wherein said step of 
generating generates characteristic data from a plurality of known computer programs to 
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enable detection of any of said plurality of known computer programs within said packed 
computer program.[.] 

52. (cancelled) 

53. (original) A method as claimed in claim 49, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

54. (original) A method as claimed in claim 49, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

55. (original) A method as claimed in claim 54, wherein said storage location of 
said resource item is specified as an relative offset value, 

56. (original) A method as claimed in claim 49, wherein said resource data 
specifies for each resource item a size of said resource item. 
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57. (currently amended) A method as claimed in claim f S2149. wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of; 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

58. (cancelled) 

59. (currently amended) A method as claimed in claim [52]49, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resource item having a largest size, 

60. (currently amended) A method as claimed in claim [52]49, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

61. (cancelled) 

62. (original) A method as claimed in claim 57, wherein said checksum value is 
rotated between each item being added into said checksum. 
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63. (original) A method as claimed in claim 49, wherein said packed computer 
file includes an xmpacking computer program which upon execution decompresses said 
known computer program. 

64. (original) A method as claimed in claim 49, wherein said packed computer 
file is a Win32 PEfile, 

65. (currently amended) Apparatus for detecting a known computer program 
within a packed computer file, said packed computer file being unpacked upon execution, 
said apparatus comprising: 

a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a resource data comparator for generating characteristics of said resource data and 
for comparing said characteristics of said resource data with characteristics of resource 
data of said known computer program for detecting a match with said known computer 
program indicative of said packed computer file containing said known computer 
program.; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program; 
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wherem said fingerprint data includes a number of program resource items 
specified within said resource data: 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data . 

66. (original) Apparatus as claimed in claim 65, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

67. (previously presented) Apparatus as claimed in claim 65, wherein said 
resource data comparator is operable to compare said resource data with characteristics of 
a plurality of known computer programs to detect if said packed computer program 
contains one of said plurality of known computer programs. 

68. (cancelled) 

69. (original) Apparatus as claimed in claim 65, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
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menu data; and 
language data. 

70. (original) Apparatus as claimed in claim 65, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

71. (original) Apparatus as claimed in claim 70, wherein said storage location of 
said resource item is specified as an relative offset value. 

72. (original) Apparatus as claimed in claim 65, wherein said resource data 
specifies for each resource item a size of said resource item. 

73. (currently amended) Apparatus as claimed in claim [68]65, wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data. 

74. (cancelled) 
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75. (currently amended) Apparatus as claimed in claim [68]65, wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resource item having a largest size. 

76. (currently amended) Apparatus as claimed in claim [6 8] 65, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

77. (cancelled) 

78. (original) Apparatus as claimed in claim 73, wherein said checksum value is 
rotated between each item being added into said checksum. 

79. (original) Apparatus as claimed in claim 65, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

80. (original) Apparatus as claimed in claim 65, wherein said packed computer 
file is a Win32 PE file. 

8h (currently amended) Apparatus for generating data for detecting a known 
computer program within a packed computer file, said packed computer file being 
unpacked upon execution, said apparatus comprising: 
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a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a characteristic data generator for generating characteristic data associated with 
said resource data for comparison with characteristic data of resource data of said known 
computer program and for detecting a match with said known computer program 
indicative of said packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said fingerprint data with fingerprint data of said known 
computer program: 

wherein said fingerprint data includes a number of program resource items 
specified within said resource data: 

wherein said fingerprint data includes a flag indicating which data is included 
within said fingerprint data . 

82. (original) Apparatus as claimed in claim 81, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program, 

83. (currently amended) Apparatus as claimed in claim 81, wherein said 
characteristic data generator is operable to generate characteristic data from a plurality of 
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known computer programs to enable detection of any of said plurality of known 
computer programs within said packed computer program.[.] 

84. (cancelled) 

85. (original) Apparatus as claimed in claim 8 1 , wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

86. (original) Apparatus as claimed in claim 81, wherein said resource data 
specifies for each resource item a storage location of said resource item. 

87. (original) Apparatus as claimed in claim 86, wherein said storage location of 
said resource item is specified as an relative offset value. 

88. (original) Apparatus as claimed in claim 81, wherein said resource data 
specifies for each resource item a size of said resource item. 
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89. (currently amended) Apparatus as claimed in claim [84]8i> wherein said 
fingerprint data includes a checksum value calculated in dependence upon one or more 
of: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data; 

string names associated with program resource items within said resource data; 

and 

sizes of program resource items within said resource data, 

90. (cancelled) 

91. (currently amended) Apparatus as claimed in claim [84] 81^ wherein said 
fingerprint data includes a location within said resource data of an entry specifying a 
program resource item having a largest size. 

92. (currently amended) Apparatus as claimed in claim [84]8i, wherein said 
fingerprint data includes timestamp data indicative of a time of compilation of said 
known computer program. 

93. (cancelled) 

94. (original) Apparatus as claimed in claim 89, wherein said checksum value is 
rotated between each item being added into said checksum. 



PAGE 29/34 * RCVD AT 12/1212005 10:23:08 PM (Eastern Standard Time] * SVR:USPTO-EFXRF-6/24 * DNIS:27383O0 * CSiD:4089714660 * DURATION (mm-ss):06-12 



DEC. 1 2. 2005 7:37PM ZILKA-KOTAB, PC 

-23- 



NO. 1293 P. 30 



95. (original) Apparatus as claimed in claim 8 1, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

96. (original) Apparatus as claimed in claim 81, wherein said packed computer 
file is a Win32 PE file. 
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